client-side authentication is working